firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ── Users ────────────────────────────────────────────────────────────────
    // Each user can only read/write their own profile document.
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }

    // ── Safety Ratings ───────────────────────────────────────────────────────
    // Any authenticated user can submit a rating.
    // Anyone can read ratings (needed for route colour-coding).
    match /safety_ratings/{ratingId} {
      allow read: if true;
      allow create: if request.auth != null
                    && request.resource.data.keys().hasAll([
                         'latitude', 'longitude', 'rating',
                         'gridId', 'timeSlot', 'timestamp', 'userId'
                       ])
                    && request.resource.data.rating is int
                    && request.resource.data.rating >= 1
                    && request.resource.data.rating <= 5
                    && request.resource.data.userId == request.auth.uid;
      allow update, delete: if false; // Ratings are immutable once submitted
    }

    // ── Checkpoints ──────────────────────────────────────────────────────────
    // Any authenticated user can read all checkpoints.
    // Any authenticated user can submit a new checkpoint.
    // Verification increments are allowed by any authenticated user.
    match /checkpoints/{checkpointId} {
      allow read: if true;
      allow create: if request.auth != null;
      allow update: if request.auth != null
                    && request.resource.data.diff(resource.data).affectedKeys()
                         .hasOnly(['verificationCount', 'verifiedBy', 'isVerified']);
      allow delete: if false;
    }

    // ── Journeys ─────────────────────────────────────────────────────────────
    match /journeys/{journeyId} {
      allow read, write: if request.auth != null
                         && request.auth.uid == resource.data.userId;
      allow create: if request.auth != null;
    }

    // ── Disaster cache (read-only for clients) ────────────────────────────────
    match /disaster_cache/{doc} {
      allow read: if true;
      allow write: if false; // Written only by server-side functions
    }
  }
}